Skip to content

Commit b4a3109

Browse files
authored
Merge pull request #2628 from Akury83/master
Update to include new style FUID chips, and fix an old nomenclature
2 parents b5dcdc6 + 53e8f56 commit b4a3109

File tree

1 file changed

+16
-4
lines changed

1 file changed

+16
-4
lines changed

doc/magic_cards_notes.md

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1043,7 +1043,7 @@ No implemented commands today
10431043
| 7AFF000000000000BAFA000000000008 | UFUID |
10441044
| 7AFF0000000000000000000000000008 | ZUID |
10451045

1046-
*Not all tags are the same!* UFUID, ZUID and PFUID* are not full implementations of Magic85 - they only acknowledge the first 8 (except wakeup command) and last config byte(s).
1046+
*Not all tags are the same!* UFUID, ZUID and PFUID* are not full implementations of USCUID - they only acknowledge the first 8 (except wakeup command) and last config byte(s).
10471047

10481048
*Read and write config commands are flipped
10491049

@@ -1053,9 +1053,9 @@ Well-known variations are described below.
10531053

10541054
^[Top](#top)
10551055

1056-
Known as "write only once", which is only partially true.
1056+
Known as "write only once", which is only partially true. Please note that some newer FUIDs have had ton configration blocks locked down and are truly a write-once tag.
10571057

1058-
Allows direct write to block 0 only when UID is default `AA55C396`. But always could be rewritten multiple times with backdoors commands.
1058+
Allows direct write to block 0 only when UID is default `AA55C396`. If your tag responds to a gen4 magic wakeup, the UID could always be rewritten multiple times with backdoors commands.
10591059

10601060
Backdoor commands are available even after the personalization and makes that tag detectable.
10611061

@@ -1074,6 +1074,8 @@ That's a key difference from [OTP](#mifare-classic-direct-write-otp)/[OTP 2.0](#
10741074

10751075
^[Top](#top)
10761076

1077+
Unlocked tag type:
1078+
10771079
```
10781080
hf mf info
10791081
...
@@ -1082,6 +1084,15 @@ hf mf info
10821084
10831085
```
10841086

1087+
or locked down tag type:
1088+
1089+
```
1090+
hf mf info
1091+
...
1092+
[+] Magic capabilities... Write Once / FUID
1093+
1094+
```
1095+
10851096
### Parsed configuration
10861097

10871098
^[Top](#top)
@@ -1103,6 +1114,7 @@ hf mf info
11031114
[+] 00 .. Unknown
11041115
[+] 08 SAK
11051116
```
1117+
**Note: this is only possile on the FUID style that has not been locked down.
11061118

11071119
### Commands
11081120

@@ -1115,7 +1127,7 @@ hf mf info
11151127
* Write hidden block: `A8xx+crc`, `[16 bytes data]+crc`
11161128
* Read configuration: `E000+crc`
11171129
* Write configuration: `E100+crc`
1118-
* Example of changing block 0 after the personalization:
1130+
* Example of changing block 0 after the personalization (only possible on tags that have not been locked down):
11191131

11201132
```
11211133
[usb] pm3 --> hf 14a raw -k -a -b 7 20

0 commit comments

Comments
 (0)